GDPR
GDPR Risk Assessment for SMBs: When You Need One and How to Do It
GDPR Article 32 requires risk-based security and Article 35 mandates a DPIA for high-risk processing. A practical five-step assessment for SMBs.
Read more →
GDPR
GDPR: practical guides for SMBs
23 articles
The GDPR applies to every business that handles personal data. If you have customers, employees, or a website, that includes you. Compliance doesn't have to be overwhelming, though. This category collects practical guides, checklists, and explainers that help SMBs tackle GDPR requirements one step at a time.
GDPR
DPIA Guide for SMBs: When You Need One and How to Complete It
When does GDPR require a DPIA — and what must it contain? Practical guide for SMBs with concrete examples, a step-by-step process, and a checklist you can use.
Read more →
AI Act, GDPR, Compliance, SME
How to Build an AI Inventory for EU AI Act Compliance (Step-by-Step)
Learn what an AI inventory is, why you need one under the EU AI Act, and how to build one step by step as an SME. With practical template and real-world examples.
Read more →
GDPR
GDPR Rules for Business Software: Which Tools Can Employees Use?
GDPR sets rules for business software employees use. Here is how to tackle shadow IT, evaluate tools, and build a software register.
Read more →
GDPR, Compliance, SMB
How to Run a GDPR Audit as an SMB (Practical Steps)
A GDPR audit doesn't have to be complicated. Learn what to check, how to approach it, and how to stay compliant as an SMB. With a practical checklist.
Read more →
GDPR
Data Processing Agreement (DPA): What Must Be in It and How to Close One
What goes in a data processing agreement under GDPR? The 7 mandatory clauses from Article 28, how to request a DPA from suppliers, and what to do when a vendor refuses.
Read more →
GDPR, Compliance, SMB
7 Common GDPR Mistakes SMBs Make (And How to Avoid Them)
The 7 most common GDPR mistakes small and medium businesses make. With real enforcement examples and practical steps to fix each one.
Read more →
GDPR
Build a GDPR Processing Register in 7 Steps
Build a GDPR processing register in 7 steps. Real examples for SMBs — audit-ready, Article 30 compliant, and built for client questionnaires.
Read more →
GDPR
GDPR Encryption: What Article 32 Requires
What encryption does GDPR Article 32 actually require? The exact standards Dutch SMBs must implement: AES-256, TLS 1.2, and full-disk encryption.
Read more →
GDPR, Compliance, SMB
GDPR data subject rights: what they are and how to handle them
All GDPR data subject rights explained, with practical guidance on handling access, erasure, and other GDPR requests within your organisation.
Read more →
GDPR, Compliance, SMB
Data Breach Response Plan: GDPR Step-by-Step Guide for SMBs (72-Hour Deadline)
72-hour deadline, regulator notification, data subject letters — this step-by-step GDPR response plan for SMBs covers every action, in the right order, so nothing gets missed.
Read more →
GDPR, Compliance, SMEs
GDPR Compliance Checklist for Dutch Tech SMBs — Audit-Ready in 2026
Complete GDPR checklist for Dutch tech SMBs: governance, DPA agreements, data retention, vendor security, and the evidence you need to pass an AP audit in 2026.
Read more →
AI, GDPR
AI Governance for EU SMEs: A Practical Framework for AI Act Compliance
AI tools in every team, but no governance in place? This step-by-step framework covers AI inventory, risk tiers, GDPR checks, and a 14-day rollout plan for EU SMEs.
Read more →
GDPR
Understanding Legitimate Interest under GDPR
Learn what legitimate interest means under GDPR, when you can use it as a legal basis, and why a balancing test is essential.
Read more →
GDPR
Why You Need to Care About EU Privacy Laws Even Outside of the EU
GDPR and ePrivacy apply based on who you serve, not where you are. Learn why respecting EU privacy laws matters even if your company is outside Europe.
Read more →
General, GDPR
GDPR Cold Calling: What's Still Allowed?
B2B cold outreach is still legal under GDPR — if you follow the rules. Here is what ePrivacy allows, where the line is, and how to stay on the right side of it.
Read more →
GDPR
What Data Needs a User’s Consent?
Learn when user consent is mandatory under GDPR. Find out why legitimate interest is not enough for sensitive data, tracking, and behavioral advertising.
Read more →
GDPR
How to build a GDPR-compliant data retention policy
Learn how to create a GDPR-compliant data retention policy to protect personal data and ensure legal compliance with our step-by-step guide.
Read more →
GDPR
Just because it’s online doesn’t mean it’s fair game: GDPR and public data
Understand GDPR's impact on public data usage and learn why accessing doesn't equal permission for personal information.
Read more →
GDPR
The role of encryption in GDPR compliance
Discover how encryption is vital for GDPR compliance and learn practical steps to protect your data from breaches and fines.
Read more →
GDPR, NIS2
What is NIS2?
NIS2 is the EU's updated cybersecurity directive, enhancing protections for critical infrastructures and ensuring businesses take cybersecurity seriously.
Read more →
GDPR
Data Controllers and Processors Under GDPR: What Dutch SMBs Need to Know
What is a data controller versus a data processor under GDPR? Practical explanation for Dutch SMBs: who is liable, when you need a DPA, and common mistakes to avoid.
Read more →
GDPR
Why GDPR is so important?
Discover why GDPR compliance is essential for businesses and how ComplianceHive simplifies the process, ensuring data protection and efficiency.
Read more →
Frequently asked questions
Does the GDPR apply to small businesses?
Yes. The GDPR applies to any organisation that processes personal data, regardless of size. If you store customer emails, employee records, or website analytics data, you need to comply. There is no small-business exemption.
What GDPR mistakes do SMBs make most often?
Common ones: missing or incomplete records of processing activities, outdated privacy policies, and no data processing agreements with vendors. Many small businesses also lack clear retention periods for the data they collect.
Where should I start with GDPR compliance?
Map what personal data you collect, where it is stored, and who can access it. Write that down in a record of processing activities. That inventory becomes the foundation for everything else, from privacy policies to vendor assessments.
ComplianceHive makes it manageable
From theory to practice — manage your compliance in one platform.